Vulnerability in Php
CVE-2010-2094
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.
EPSS: 0.122 (95.7th percentile) — read the EPSS interpretation.
Affected products
- Php — versions 5.3.1, 5.3.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (Exploit, x_refsource_MISC)